feat(extension): add PR sidebar Gittensory context panel

[JSONbored]

Background

The highest-value extension surface is a private PR sidebar panel. It gives users context without adding GitHub comment noise.

Goal

Add a private overlay panel on GitHub PR pages with Gittensory contribution context.

Current Behavior

Users need to invoke MCP or read GitHub comments to see Gittensory context.

Desired Behavior

On a GitHub PR page, an authenticated user can open a Gittensory panel for confirmed-miner context, lane fit, blockers, and packet actions.

Implementation Requirements

• Detect owner/repo/PR from GitHub URL.
• Fetch authenticated PR intelligence from Gittensory API.
• Show public-safe packet actions and private blocker details based on role.
• Do not post comments automatically.
• Handle non-miner, bot, maintainer, and unavailable detection states.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Shows confirmed-miner context, lane fit, duplicate risk, linked issue state, queue pressure, and public-safe packet actions.
• Does not post comments automatically.
• Handles non-miner and unavailable detection.
• Tests cover DOM route matching and API redaction.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.